06-26-2019, 10:55 AM
Some interesting data I collected from your log file:
- Most ghost sessions were created by Firefox (>90%).
- They all have the same IP addresses of legitimate users (same IP address has another "normal" session, at an earlier point in time)
- almost all ghost sessions have only one request. The request created a new session and session creation events ran until completion (no exceptions)
- after this first request, session stays inactive (it is alive but doesn't receive any other request) but is not collected by timeout thread
Given this information, seems to me that (the ultra-mega-stupid) Firefox "feature" which refreshes the toolbar images in "Top sites" toolbar is responsible for that "ghost" request.
However, this "feature" is well known and we have extensively tested this behavior. I'm not sure if some initialization code you have might be interfering with this...
The normal behavior would be:
- First request creates a session. Timeout of that session is set to 1 minute (the minimum timeout).
- If no other request is received, the session will be collected by the timeout thread on its first (or second) run (it runs once each 1 minute)
- If a second request is received, the session timeout of that specific session is set to the default value specified by server controller
- Most ghost sessions were created by Firefox (>90%).
- They all have the same IP addresses of legitimate users (same IP address has another "normal" session, at an earlier point in time)
- almost all ghost sessions have only one request. The request created a new session and session creation events ran until completion (no exceptions)
- after this first request, session stays inactive (it is alive but doesn't receive any other request) but is not collected by timeout thread
Given this information, seems to me that (the ultra-mega-stupid) Firefox "feature" which refreshes the toolbar images in "Top sites" toolbar is responsible for that "ghost" request.
However, this "feature" is well known and we have extensively tested this behavior. I'm not sure if some initialization code you have might be interfering with this...
The normal behavior would be:
- First request creates a session. Timeout of that session is set to 1 minute (the minimum timeout).
- If no other request is received, the session will be collected by the timeout thread on its first (or second) run (it runs once each 1 minute)
- If a second request is received, the session timeout of that specific session is set to the default value specified by server controller